Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq fiddler*" /IM * /F /T
- '<SYSTEM32>\net.exe' stop ESEADriver2
- '<SYSTEM32>\net.exe' stop FACEIT
- '<SYSTEM32>\taskkill.exe' /IM "EasyAntiCheat.exe" /F
- '<SYSTEM32>\taskkill.exe' /IM "FortniteClient-Win64-Shipping_EAC.exe" /F
- '<SYSTEM32>\taskkill.exe' /IM "FortniteClient-Win64-Shipping_BE.exe" /F
- '<SYSTEM32>\taskkill.exe' /IM "FortniteClient-Win64-Shipping.exe" /F
- '<SYSTEM32>\net.exe' stop BEDaisy
- '<SYSTEM32>\taskkill.exe' /IM "FortniteLauncher.exe" /F
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq ida*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq cheatengine*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq charles*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq rawshark*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq wireshark*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /IM "EpicGamesLauncher.exe" /F
- '<SYSTEM32>\net.exe' stop EasyAntiCheat
Network activity
TCP
- 'ch###loverz.com':443
UDP
- DNS ASK ch###loverz.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /C "SystemSettingsAdminFlows.exe SetInternetTime 1"
- '<SYSTEM32>\net1.exe' stop FACEIT
- '<SYSTEM32>\net1.exe' stop ESEADriver2
- '<SYSTEM32>\net1.exe' stop BEDaisy
- '<SYSTEM32>\net1.exe' stop EasyAntiCheat
